18

I run:

show grants for root@localhost;

and I see

 GRANT PROXY ON ''@'' TO 'root'@'localhost' WITH GRANT OPTION

From mysql docs:

https://dev.mysql.com/doc/refman/5.5/en/proxy-users.html

This enables the external user to be a proxy for the second user; that is, to have the privileges of the second user. In other words, the external user is a “proxy user” (a user who can impersonate or become known as another user) and the second user is a “proxied user” (a user whose identity can be taken on by a proxy user).

But I am not understanding what they mean. I got the system from another worker who left the job and want to make sure if everything is secure and do not know if this grant is even needed. But if it does not make any security issues, I can leave it.

Can somebody explain in more simple way?

Update:

How can I connect as as another user? I was trying various combinations, of username password, but I cannot make it connect.

For example I used user root, but password from another user, which did not work. Tried another user and root password, also did not work.

Update:

Or this maybe means that root user can connect as other user? How to do that at least for example if so?

1
  • "The initial root account created during MySQL installation has the PROXY ... WITH GRANT OPTION privilege for ''@'', that is, for all users and all hosts. This enables root to set up proxy users, as well as to delegate to other accounts the authority to set up proxy users." From docs here: dev.mysql.com/doc/refman/5.5/en/proxy-users.html
    – Katie
    Mar 9, 2019 at 0:39

2 Answers 2

4

MySQL User Authentication is a rather lengthy process to explain. I refer you to my 3.5-year-old answer to MySQL error: Access denied for user 'a'@'localhost' (using password: YES) so you can see the steps a user takes to authenticate.

What the PROXY grant does is allow one user to masquerade as another user and bypass MySQL's normal but lengthy user authentication protocol.

Such proxy grants could be a security hole if one knew of this and started taking advantage of it. The quickest way to deactivate this would be to run

TRUNCATE TABLE mysql.proxies_priv;
FLUSH PRIVILEGES;

This will wipe out the current proxy privileges.

Afterwards, if you want to restrict proxy privileges, go to the OS and do this:

cd /var/lib/mysql/mysql
chmod -w proxies_priv.*

This will prevent new proxy privileges from being created.

GIVE IT A TRY !!!

3
  • 1
    What if something breaks if I truncate table? I can before truncating - export it and if something breaks, then insert those rows again and should everything work I hope. I see there are 2 rors in the table.
    – Darius.V
    Jul 10, 2015 at 8:29
  • My coworkers say that there is no security hole, because it is root and he has all rights anyway. But maybe they did not understand why I ask - can I connect with some non root user as root user because there is proxy and then have rights?
    – Darius.V
    Jul 10, 2015 at 9:33
  • 2
    Note: this answer doesn't show how to use the proxy feature Nov 29, 2019 at 3:49
1

As a complementary answer (to explain why proxy users are useful), you can think of proxied users as "roles" and proxy users as "users you give a role to".

For example, if you know your interns should only read from the DB (not write), you can create a proxied user called intern with GRANT SELECT, and then, for each of your interns, you create a proxy user with GRANT PROXY ON 'intern@localhost' TO 'name_of_the_intern@localhost'

The MySQL docs gives a good example:

One administrative benefit to be gained by proxying is that the DBA [DataBase Admin] can set up a single account with a set of privileges and then enable multiple proxy users to have those privileges without having to assign the privileges individually to each of those users. As an alternative to proxy users, DBAs may find that roles provide a suitable way to map users onto specific sets of named privileges. Each user can be granted a given single role to, in effect, be granted the appropriate set of privileges.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.